[BUG][ASPNETCORE] Fallback to HttpContext as resource in authorization handler

[alec-petersen]

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?
• [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

Referencing this announcement and this more helpful StackOverflow Answer, we need to make a change in the ApiAuthentication file with the AuthorizationHandler to fallback to HttpContext because that is the new default resource that will be provided to the handler.

openapi-generator version

7.18

I'll open a PR shortly with my suggested changes, which is just supporting both.

[alec-petersen]

I think the more idiomatic fix actually would be to implement an AuthenticationHandler for api key validation..

[alec-petersen]

For a spec like this:

components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-MY-API-KEY

I'm thinking something more like this in ApiAuthentication.cs:

    public static class SchemeNames {
        public const string ApiKeyAuthenticationScheme = "ApiKeyAuth";
    }

    public class ApiKeyAuthenticationSchemeOptions: AuthenticationSchemeOptions {
        public ISet<string> ApiKeys {get; } = new HashSet<string>(StringComparer.Ordinal);
        public string HeaderName {get; set; }
    }
    
    public class ApiKeyAuthenticationHandler : AuthenticationHandler<ApiKeyAuthenticationSchemeOptions> {
        public ApiKeyAuthenticationHandler(IOptionsMonitor<ApiKeyAuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder) 
            : base(options, logger, encoder) { }
        
        protected override Task<AuthenticateResult> HandleAuthenticateAsync() {
            if (!Request.Headers.TryGetValue(Options.HeaderName, out var values))
                return Task.FromResult(AuthenticateResult.NoResult());

            var providedKey = values.ToString();
            
            if (string.IsNullOrWhiteSpace(providedKey) )
                return Task.FromResult(AuthenticateResult.NoResult());

            if (!Options.ApiKeys.Contains(providedKey))
                return Task.FromResult(AuthenticateResult.Fail("Invalid API key"));

            var claims = new[]
            {
                new Claim(ClaimTypes.NameIdentifier, "apikey-client"),
                new Claim(ClaimTypes.Name, "ApiKeyClient"),
            };

            var identity = new ClaimsIdentity(claims, Scheme.Name);
            var principal = new ClaimsPrincipal(identity);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);

            return Task.FromResult(AuthenticateResult.Success(ticket));
        }
    }
}

Program.cs looks like this:

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = SchemeNames.ApiKeyAuthenticationScheme;
        options.DefaultChallengeScheme = SchemeNames.ApiKeyAuthenticationScheme;
    })
    .AddScheme<ApiKeyAuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
        SchemeNames.ApiKeyAuthenticationScheme, options => {
            options.ApiKeys.Add("HI");
            options.HeaderName = "X-MY-API-KEY";
        });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy(SchemeNames.ApiKeyAuthenticationScheme, policy =>
    {
        policy.AddAuthenticationSchemes(SchemeNames.ApiKeyAuthenticationScheme);
        policy.RequireAuthenticatedUser();
    });
});

We could keep the existing AuthorizationHandler and just mark it [Obsolete]